Internal Audit of Payment Application

Final Report

Audit, Evaluation, and Risk Branch
October 2013


Executive Summary

Background

The Canada Revenue Agency (CRA) is responsible for assessing and collecting a wide variety of income taxes and other taxes on behalf of the federal, provincial, and territorial governments. To that effect, the CRA offers individuals and businesses various means to pay their taxes and remittances such as by mail, at their financial institution, or electronically.

The CRA is committed to ensuring accurate, efficient and effective processing of individual and business tax returns and payments to protect Canada's tax base and help Canadians meet their tax obligations. The ultimate objective is to process all payments and apply them to the taxpayers' (TP) Footnote 1 accounts in a timely and effective manner, and deposit these daily into the account of the Receiver General.

The Assessment and Benefit Services Branch (ABSB) has functional authority over payment processing, including its policies and procedures. Within ABSB, the Horizontal Integration Directorate is responsible for payment processing, while the Business Returns Directorate and the Individual Returns Directorate are responsible for accounting, including payment adjustments.

In addition, the Taxpayer Services and Debt Management Branch is responsible for providing taxpayers with general payment information, and has functional authority over individual and business call centres, trust account programs, and collections which also provide payment information and perform adjustments.

During the 2012-2013 fiscal year, the CRA processed more than 35.5 million payments totalling more than $433 billion, of which 11.8 million were direct Footnote 2 payments, 10.7 million were payments made through financial institutions Footnote 3 , and 13.0 million were electronic Footnote 4 payments.

As the payment landscape rapidly shifts towards payments being increasingly initiated electronically through third parties, CRA must continue to adapt to this "drive to electronic" Footnote 5 , by continuing to "integrate the taxpayer experience" Footnote 6 in providing the appropriate educational and remittance tools allowing taxpayers to efficiently and effectively meet their tax obligations.

Objective

The objective of this internal audit was to provide assurance that payments are credited appropriately to TP accounts and that controls are in place to detect, correct and prevent incorrect application of payments.

This audit was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing.

Conclusion

This internal audit found that the vast majority of payments were credited appropriately to TP accounts. Results from testing a statistically representative sample of 845 payments from the 2010-2011 fiscal year revealed that 2.0% (17) of these payments were misapplied. However, out of the 17 misapplied payments that were found, none of them were misallocated to an account of another taxpayer. The 2.0% misapplied payment error rate emerging from the sample falls within the 3.0% tolerance level established at the outset of this audit. These results are based on the standard 95.0% confidence level.

In the absence of a common CRA definition, Internal Audit defined a MAP for the purposes of its audit tests. By MAP is meant, "where the initial payment, after having passed through the complete CRA payment application process, became the object of a request for re-application (transfer request) on the part of a TP through the appropriate CRA point of service". Furthermore a MAP is also defined "regardless of fault". It is important to make a distinction between a CRA error causing a MAP and a taxpayer error causing a MAP in that the level of control is different and the mitigating strategies will also vary.

Internal Audit's sample analysis revealed that 8 out of 17 (or 47.0% Footnote 7 ) of the MAPs were initiated/processed electronically by taxpayers via the on-line payment services of their financial institutions. This requires that CRA focus on the application risks associated with on-line banking payments which increased from 26.0% to 33.0% of CRA's total payments between 2009-2010 and 2012-2013.

Other opportunities exist to improve controls to prevent, detect and correct the misapplication of payments. A horizontally-integrated risk approach is lacking to identify, assess and mitigate risks to allow the CRA to adjust to the electronic shift in the payment landscape.

Action plan

ABSB has established a working group to address Internal Audit's recommendations as well as to monitor the implementation of their action plans. Their action plans include conducting a risk assessment of its payment application workflows as a means of strengthening existing controls as well as develop new ones, if needed. ABSB is also working with Public Works and Government Services Canada by reaching out to the financial community and sharing the CRA's e-payment agenda including reducing barriers to e-payments, new e-payment options and raising taxpayer awareness of online banking services.

Introduction

The Canada Revenue Agency (CRA) is responsible for assessing and collecting a wide variety of income taxes and other taxes on behalf of the federal, provincial, and territorial governments. To that effect, the CRA offers individuals and businesses and their representatives various means to pay their taxes and remittances: through their financial institution in person or electronically, to CRA by mail or via its E-services (My Payment).

The CRA is committed to ensuring accurate, efficient and effective processing of individual and business tax returns and payments to protect Canada's tax base and help Canadians meet their tax obligations. The ultimate objective is to process all payments and apply them to the taxpayers' (TP) Footnote 8 accounts in an efficient and timely manner, and deposit these payments daily into the account of the Receiver General.

The Assessment and Benefit Services Branch (ABSB) has functional authority over payment processing, including its policies and procedures. Within ABSB, the Horizontal Integration Directorate (HID) is responsible for horizontal initiatives, business reconciliation and payment processing, while the Business Returns Directorate and the Individual Returns Directorate are responsible for accounting, including payment adjustments.

Payment processing operations are performed by revenue processing employees located in tax centres (TCs) and the Ottawa Technology Centre (OTC) whereas payment adjustments are carried out by designated payment accounting areas in the TCs and at the OTC.

In addition, the Taxpayer Services and Debt Management Branch (TSDMB) is responsible for providing taxpayers with general payment information, and has functional authority over individual and business call centres, trust account programs and collections which also provide payment information and perform adjustments. During the 2012-2013 fiscal year, the CRA processed more than 35.5 million payments totalling more than $433 billion, of which 11.8 million were direct Footnote 9 payments, 10.7 million were payments made through financial institutions (FI) Footnote 10 , and 13.0 million were electronic Footnote 11 payments.

As the payment landscape rapidly shifts towards payments being increasingly initiated electronically through third parties, CRA must continue to adapt to this "drive to electronic" Footnote 12 , by continuing to "integrate the taxpayer experience" Footnote 13 in providing the appropriate educational and remittance tools allowing taxpayers to efficiently and effectively meet their tax obligations.

The Office of Taxpayers' Ombudsman (OTO) recently conducted an investigation of service and fairness issues arising from the misallocation of payments by CRA. Their report, dated July 2012 recommended that CRA "review its standards and procedures for processing payments to ensure that clerks are afforded sufficient time to perform their duties with accuracy as well as efficiency". In addition, they recommended that CRA "inform and educate taxpayers on how to avoid making remittance errors as well as how to have them corrected when they do occur". The CRA advised the OTO that "it would begin to 'compile statistics which will be used to identify the cause of errors and assist in the development of preventative measures'".

Focus of the Audit

The objective of this internal audit was to provide assurance that payments are credited appropriately to taxpayer and registrant accounts and that controls are in place to detect, correct and prevent incorrect application of payments.

The audit was conducted mainly in the ABSB, at the OTC, and in selected sites in the Atlantic, Ontario, and Pacific regions. The examination phase took place from January 2012 to February 2013.

Findings, Recommendations and Action Plans

A statistically-representative sampling of all Individual (T1), Corporate (T2), Goods and services tax/Harmonized sales tax (GST/HST) and Source Deductions (Paydac) payments, drawn from 96.2% (or 32 861 300 payments) of the total population of the 34 147 035 total payments received from April 1, 2010 to March 31 2011 was performed by Internal Audit. This fiscal year was chosen to allow coverage of two T1 filing periods; non-traditional Financial Year Ends (other than Dec 31st) for T2 and ensured that more than a full year to date elapsed thereby providing adequate time for TPs to identify problems with payments processed in 2010-2011.

The analysis of the sample of 845 payments revealed 17 misapplied payments (MAPs) (or 2.0% of the sample). However, none of these payments were misallocated to an account of another taxpayer. The 2.0% misapplied payment error rate emerging from the sample falls within the 3.0% tolerance level established at the outset of this audit. These results are based on the standard 95.0% confidence level.

In absence of a common CRA definition, Internal Audit defined a MAP for the purposes of its audit tests. By MAP, is meant where the initial payment, after having passed through the complete CRA payment application process, became the object of a request for re-application (transfer request) on the part of a TP through the appropriate CRA point of service (Call Centre, Business Window, mailed-in correspondence or verbal communication to TCs/OTC/Tax Services Offices). Furthermore a MAP is also defined "regardless of fault". It is important to make a distinction between a CRA error causing a MAP and a taxpayer error causing a MAP in that the level of control is different and the mitigating strategies will also vary.

1.0 Monitoring

Internal audit noted that ad hoc projects were undertaken to generate volume estimates and reasons for potentially misapplied payments (PMAPs) Footnote 14 and MAPs. These projects produced statistics on the number of payment error cases and "payment/credit" enquiries, analysis of samples of corrected and transferred payments as well as the review of taxpayer payment-related complaints Footnote 15 . However these initiatives did not provide the level of detail, completeness, or statistical representation required in determining root causes of PMAPs and MAPs. In addition, current functionalities and capabilities of case management systems do not provide the necessary level of detail (fields and corresponding codes) to assist in identifying PMAPs and MAPs. Consequently, trends and patterns may not be easily identified in order to determine corrective actions.

Internal audit conducted a review of procedures related to "misapplied" or "misallocated" Footnote 16 payments which provided reasons why payments may not be credited to accounts and what steps need to be performed to trace such payments. However, a standard definition of a MAP does not exist across the CRA. Some CRA personnel interviewed considered a payment misapplied if it was not applied correctly on its initial posting. Other employees considered a payment as misapplied only when the TP became aware of its misapplication and contacted CRA to have the payment transferred. As a result, ABSB is not able to track the extent to which MAPs and PMAPs exist in order to address their actual causes in a coordinated meaningful manner. This would assist in determining appropriate resource levels and/or controls to transfer, proactively correct and prevent misapplied payments.

Recommendations

ABSB should develop and communicate an Agency-wide definition of a MAP for consistency.

ABSB should conduct a feasibility study in considering an update to its systems' functionalities and capabilities to enable the extraction of complete and accurate data with respect to MAPs and PMAPs to be able to develop a consistent and reliable method of analysing and identifying causes and trends to strengthen the internal controls payment application processes.

Action Plan

ABSB will develop a general definition of a MAP. This definition will be communicated to all internal partners by October 2013. It is important to make a distinction between a CRA error causing a MAP and a taxpayer error causing a MAP in that the level of control is different and the mitigating strategies will also vary. When CRA processes payments as instructed by the TP, whether it is a direct or electronic payment, this should not be considered a misapplied payment by the CRA.

ABSB is researching what the T1, Standardized Accounting and Paydac accounting systems can do regarding the implementation of reason codes for misapplied payments. In consultation with stakeholders, ABSB is considering the development of system validations to identify causes and trends related to MAPs and PMAPs and to strengthen internal controls on payment application processes. This feasibility study will be completed by June 2014.

2.0 Risk Management

Documented risk analysis has not been performed either in ABSB or horizontally within CRA, in order to identify, evaluate, address and regularly monitor the risks associated with PMAPs and MAPs. In addition, interviews conducted at the local, regional and national levels indicate that risk assessments were not performed with respect to payment application. A horizontally-integrated risk approach is lacking to identify, assess, and mitigate risks to allow the CRA to adjust to the electronic shift in the payment landscape. Completing a risk analysis will also enable the CRA to target efforts to reduce PMAPs/MAPs and establish what would be considered an acceptable error rate, based on level of effort, cost effectiveness and industry best practices.

In interviews, employees assigned to payment error correction (PEC) and to correspondence-enquiries (COR-E) accounting workflows expressed the following concerns related to the effectiveness of correcting PMAPs and transferring MAPs:

  • Production standards (number of cases to complete per hour) in most PEC workflows do not allot the required time to order and analyse payment source documents and contact the TP when required.
  • Some error/validity messages that provided flags for PMAPs were removed from PEC and COR-E workflows to reduce workloads.
  • Some procedures related to payment application, tracing, correcting and transferring, had either not been reviewed, updated, adapted or communicated in an integrated manner within ABSB and with partners (individual and business call centres, trust accounts and collections).

Recommendations

ABSB should conduct benchmarking using information from other tax administrations to assist in establishing what would be considered an acceptable error rate for the application of payments.

ABSB should adopt a horizontally-integrated risk management framework to identify, evaluate, address and regularly monitor risks related to all of its payment application workflows as a means of strengthening existing controls and developing new ones in order to reduce the frequency and impact of PMAPs and MAPs in the changing payment landscape.

Action Plan

ABSB has commenced a benchmarking exercise using the data provided by other tax administrations with respect to misapplied payments. As the CRA must rely on other tax administrations to provide this information in a timely manner, this action plan is expected to be completed by Dec 31, 2013.

ABSB will follow CRA's risk management process by conducting a risk assessment which combines electronic payments and payment application. Given the dependency of the integrated risk management framework on system improvements to track potential and misapplied payment drivers, the completion date for this action plan is May 2015.  High level key milestones are as follows:

December 2013

  • Scope established, stakeholders identified and engaged and recommended risk assessment plan completed

January 2014*

  • Launch risk assessment
  • Evaluation of automated options to track misapplied payment drivers. Should it be established that current mainframe systems cannot accommodate a new feature to capture MAP and PMAP data, the Agency will consider other automated or manual tracking methods*

* This milestone may take up to 11 months to complete given the alignment between this recommendation and the feasibility of mainframe system improvements recommended in the Audit's monitoring recommendation.

December 2014

  • Risk assessment process completed, results documented 
  • Offices of Primary Interest (OPI) assigned to each risk identified (OPIs will be responsible for the development and implementation of any resulting action plans)
  • Documentation of integrated risk framework

March 2015

  • Integrated action plan with recommended implementation approach ready for executive approval
  • Integrated risk framework for ongoing monitoring ready for review/approval

May 2015

  • Implementation of integrated risk management framework  

3.0 Payment Processing

The "Drive to electronic", one of the three levers required to deliver CRA's Vision 2020, adapts to the changing payment landscape where more payments continue to be processed electronically by taxpayers via the on-line payment services of financial institutions and via CRA's E-Services.

A review of documentation provided by the HID indicates that direct payments have been steadily decreasing in favour of electronic payments. Between 2009-2010 and 2012-2013, on-line banking payments increased 30.0% in volume and from 26.0% to 33.0% of CRA's total payments. During the same period, My Payment processed payments increased from 0.3% to 4.0% of CRA's total payments.

Results from performing a sample analysis revealed that 8 out of 17 (or 47.0% Footnote 17 ) of the MAPs and 10 out of 22 (or 45.0% Footnote 18 ) of the PMAPs in the sample of 845 payments were processed electronically by taxpayers via the on-line payment services of their financial institutions. This is an indication that the CRA should focus on the application risks associated to these payments.

A review of the on-line payment menu options for personal income tax offered by financial institutions confirmed that there is no complete and standardized menu of CRA payment options and terminology across all financial institutions.

In addition, CRA staff interviewed indicated that electronic payments are of a significant concern due to their difficult traceability: For example:

  • Source documents are not available for electronic payments, therefore when an electronic payment falls into a PEC inventory, employees are not able to consult source documents (unlike for direct payments) to verify the TP's intentions and to identify incorrect or missing information.
  • CRA staff from PEC and in Call Centres do not have access to the various on-line banking payment menus options. Staff mentioned that they would find it useful to have this information when correcting and transferring payments or assisting taxpayers with their enquiries related to on-line banking transactions.

Due to their increasing volume, electronic payments will be of greater inherent and relative risk of becoming PMAPs and MAPs over time. If payment menus (with respect to CRA remittance type, terminology, and procedures) for electronic payment services are not standardized, there is a risk that PMAPs and MAPs may increase. Without adequate tracing tools in place for electronic payments, it will take CRA staff longer to correct PMAPs. In some cases, the resulting inefficiencies will render time-sensitive proactive (PEC) controls ineffective as reliance on contact by the TP is necessary to correct a now-MAP.

Recommendations

ABSB should evaluate the risks and impacts associated with the increasing number of electronically-processed payments on its current payment business model and controls.

ABSB should consult with Public Works and Government Services Canada (PWGSC) in implementing a standardised payment menu that includes the electronic equivalent of all existing and required CRA remittance vouchers necessary for proper Agency accounting of payments.

Action Plans

ABSB will address the first recommendation during their risk assessment exercise as indicated in their action plan under 2.0 Risk Management.

Although standardized payment menus cannot be enforced, ABSB is working with PWGSC and have already taken steps to address this recommendation by reaching out to the financial community. For example, in February 2013, ABSB shared the CRA's e-payment agenda including reducing barriers to e-payments, new e-payment options and raising taxpayer awareness of online banking services.

Through ongoing communication, ABSB will develop and communicate standardized terminology when referencing the CRA as a bill payee in on-line banking payment menus and on client banking statements by June 30, 2014.

4.0 Communication with stakeholders

CRA's Vision 2020 guiding document emphasizes the need to "integrate the taxpayer experience" requiring the "Agency to stand in the shoes of the taxpayer, tax intermediaries or benefit recipient to better anticipate and respond to their service needs".

Although the CRA does not compile complete statistics on the number of and causes of PMAPs and MAPs, employees interviewed were able to identify the most frequently cited payment errors with respect to remittance information. These errors were also confirmed in our audit tests:

  • Missing, incorrect or improper remittance voucher or option;
  • Missing or incomplete account numbers and/or financial/remittance period;
  • Confusion between types of accounts: Individual; Source Deductions (RP); Corporate (RC) and GST-HST (RT);
  • Confusion between payment types (ie. Instalments, Arrears, Balance Due, Payment on Filing, etc.).

Interviews with employees from revenue processing indicated that accountants and taxpayer representatives frequently did not provide remittance vouchers to accompany their clients' payments. In addition, employees mentioned that remittance vouchers are not easily accessible to TPs. Delays after ordering them on-line/by phone or relying on system-generated mechanisms were mentioned as reasons that direct payments were not accompanied with proper remittance vouchers or were attached to generic or photocopied vouchers.

Employees also indicated that remittance terminology, tools and procedures are not completely known, understood, available or adhered to by TPs. This increases the probability of PMAPs and MAPs. Ongoing payment application issues are an indication that CRA must continue to address the need to "integrate the taxpayer experience" in providing taxpayers with the appropriate educational and remittance tools they require to meet their tax obligations.

Recommendations

ABSB should review payment application issues to isolate their corresponding causes in order to assess and continually monitor (with the involvement of internal partners and stakeholders) the effectiveness of educational tools and the performance of all remittance tools (paper or electronic) in reducing the occurrence of PMAPs and MAPs.

ABSB should leverage CRA E-services such as My Account/My Business Account as educational vehicles and further promote the use of electronic payment tools.

Action Plans

ABSB liaised with the Public Affairs Branch and, in February 2013, updated the messaging on the CRA's website to inform and educate taxpayers on how to make a remittance. The steps that were taken included improving website navigation as well as providing information on how to obtain and fill out remittance vouchers.

ABSB have also made remittance vouchers more readily available to taxpayers by implementing and/or making improvements to the "request a voucher" option through the phone lines, My Account and Quick Access options. Taxpayers may also request remittance vouchers through the Enquiries service on My Business Account.

ABSB has drafted a payment service strategy to outline the current state of payments and set out the future vision. The target date for completion is March 2014.

ABSB will continue to use the above tools, as well as leveraging third parties, to promote e-services as the taxpayer's tool of choice (including how to pay electronically).

Conclusion

This internal audit found that the vast majority of payments were credited appropriately to TP accounts. However, no evidence exists to confirm a consistent or reliable method of identifying and analysing the volumes and causes of PMAPs and MAPs to mitigate the likelihood of their occurrences.

Due to their increasing volume, electronic payments will be of greater inherent and relative risk of becoming PMAPs and MAPs over time. If payment menus (with respect to CRA remittance type, terminology, and procedures) for electronic payment services are not standardized, there is a risk that PMAPs and MAPs may increase.

As the payment landscape accelerates its shift towards the "drive to electronic" payments, the CRA is faced with additional challenges in meeting its Vision 2020 objective to "integrate the taxpayer experience" requiring the "Agency to stand in the shoes of the taxpayer, tax intermediaries or benefit recipient to better anticipate and respond to their service needs". To achieve this, ABSB will have to manage payment-related risks horizontally by working in a more integrated manner with internal partners and stakeholders and by discussing more actively with PWGSC, the liaison between the financial institutions and the CRA.

Report a problem or mistake on this page
Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, contact us.

Date modified: